I'm imagining something like this: Imagine if the NSA has a copy of these companies' (Google and Facebook's) traffic, and has perhaps subpoena'd the TLS keys.

I'm imagining something like this: Imagine if the NSA has a copy of these companies' (Google and Facebook's) traffic, and has perhaps subpoena'd the TLS keys. Having the TLS keys is still not having "direct access" to their network, since the NSA at no point accesses internals of their network. But the NSA gets all the data and decrypts it. Next, NSA engineers spend time reverse-engineering the company's protocols. Or maybe the companies hand over the specs. Anyway, the NSA can now recognize a request to Facebook representing posting a message; or it can recognize in Google's traffic someone reading or sending an email. It can tell when a file is stored into iDrive. It saves copies of all of this - the date and time of the request to Facebook, the message, etc.; for Google, the entire copy of the email, or search query. NSA stores all of this data into a searchable, queryable database, that is capable of looking up a person's activity in those systems. And retrieve the same Facebook message, Google meail, or iDrive file that the user had sent. This is a version of events that seems to fit the data I've seen. In another thread, someone suggested that PRISM records information without "tapping" the companies lines. Perhaps that is true, and the tapping happens at the Internet backbone level, without awareness by these companies (beyond giving up their TLS keys). I think the question we need to ask Google, et al., is: did you divulge your SSL/TLS keys to any government, agent of the government, or any other entity?